Approval expiry and binding for agent actions

A human approval is an authorization input for a specific proposed effect, not a reusable permission slip for any later tool call.

01 / The operating case

What changes in a real workflow?

An analyst approves an agent’s proposed $8,400 payment to vendor A. The agent later changes the amount to $84,000 or the payee to vendor B before submission.

Trace the authority boundary
  1. 01Authority origin
  2. 02Task and grant
  3. 03Current decision
  4. 04Observed outcome

02 / Decision contract

What the executor must check

Canonicalize the request before approval and bind actor, task, operation, target, amount, currency, payee, policy context and expiry to the approval artifact. Re-evaluate current grant and policy when the agent resumes; reject a changed request.

InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome

03 / Failure and evidence

What goes wrong, and what can be proven?

Failure mode

The executor checks only that “a human approved payments” and allows a modified or replayed transaction.

Evidence to retain

Retain approval actor, timestamp, displayed request digest, expiry, decision ID, consumed status, executor attempt and observed financial state.

04 / Canonical scope

Why this reference stands alone

Human approval for agent actions explains the role of a reviewer; this page owns parameter binding, expiry and reuse prevention.

Implementation review / distinct boundary

The approver must see what the executor will see.

An approval UI should show the consequence-bearing fields, not a model-written summary alone. The artifact should refer to the normalized request and a time-bounded task. When execution resumes, the caller should recheck both that artifact and the current authority chain. A valid signature on an old approval does not make a revoked grant valid again.

Approval binding fields
task: invoice I-42
actor: finance agent F-7
action: payment.release
target: account A / vendor A / USD 8,400
expires: task window; single-use
request digest: hash(canonical fields)
01

Display

Show action, target, amount or data scope, initiating principal and policy exception to the reviewer.

02

Bind

Use one canonical request digest and expiry; define whether the approval is single-use.

03

Resume

Re-evaluate after the human acts, and reject changed arguments, expired artifacts and consumed approvals.

Source context: primary specification or guidance ↗. The worked test and mapping are ProofGrid analysis.

Continue with the runtime authorization library for neighboring decision and execution questions.

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation